Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: when you create an account, we collect your name, email address and password (stored only as a one-way hash by our authentication provider).
• Billing information: when you buy a credit pack or start the Pro plan, your payment details are collected and processed directly by Stripe. We do not store your payment card details on our servers. We receive from Stripe a customer identifier, the status of your subscription and your transaction history.
• Communications: if you contact us by email or through the support chat, we collect the content of your messages and any information you choose to provide.

1.2 Data From Your Connected MercadoLibre Account

If you connect your MercadoLibre seller account, MercadoLibre issues us an access token through its OAuth authorization flow. We use that token only to act on your behalf within the Service. Specifically:

• Tokens: access and refresh tokens are stored encrypted (AES-256-GCM) and are never shown to you, to an AI model or to any client connected through Ficanaz Link. They are deleted when you disconnect the account or delete your Ficanaz account, and we revoke the authorization with MercadoLibre at the same time.
• Seller identity: your MercadoLibre user id, nickname and site (country).
• Listings and performance: your listings (titles, prices, stock, status, sales counts, images, categories, shipping settings), visits, reviews, promotions, advertising campaigns and the analyses the Service produces about them. Some of this is kept in a cache so that the Service does not have to re-read MercadoLibre on every visit.
• Sales and after-sales: orders, shipments, questions from potential buyers, post-sale messages and claims, as needed for the features you use (sales dashboard, claims review, the assistant).
• Your buyers' data: orders, questions, messages and claims include information about your buyers, such as an id, nickname, the city of a shipment and the text they wrote. We process that information only to provide the Service to you. Before any of it is sent to an AI model, the Service removes buyers' names, email addresses, phone numbers, identity documents and street addresses, and masks emails and phone numbers that appear inside free text. Payment and billing data from Mercado Pago is never requested.

1.3 Your Use of AI Features

• Product research: the category, country, filters and price you enter, are stored together with a record of each run (date, number of results and the names of the ideas generated), which is listed in your history.
• Assistant conversations: your messages to the assistant, its answers, the proposals it creates and the changes you confirm are stored in your account, together with a record of the credits each call consumed.
• Ficanaz Link activity: every call made by a connected AI client is logged with the client, the tool used, a copy of the input truncated to 4,000 characters, whether it succeeded and how long it took. The log is shown to you in the Link panel.
• Permissions: which write permissions you have enabled for the assistant.
• Ratings of assistant answers: if you rate an answer (thumbs up or down), we store your rating, the reasons you select and any comment you write, linked to that answer and its conversation.

1.4 Information Collected Automatically

• Device and request data: IP address, browser type, operating system, device type and language preference, used for security, rate limiting and routing.
• Signup source: when you register, we record the campaign parameters (UTM) and referring site of your first visit, to understand how people find Ficanaz. This is stored once and not updated.
• Product analytics: we use Vercel Analytics to understand aggregate, anonymized usage of the Service (pages visited, referral sources). It does not use persistent cookies.
• Error monitoring: we use Sentry to capture errors and performance data. We configure it not to send personal identifiers by default and we strip authentication codes and tokens from the URLs it records; an error report may still include your IP address and the page where the error happened.

1.5 Cookies and Similar Technologies

We use two categories of cookies and similar technologies:

• Strictly necessary: cookies required for authentication, session management, security and core functionality, plus a browser storage entry that remembers your language and your cookie choice. These cannot be disabled and do not require consent because the Service cannot operate without them.
• Marketing and conversion measurement (optional): with your consent, we load tracking pixels from the following providers to measure the effectiveness of our advertising campaigns and to understand how visitors arrive at the Service:
  • Meta Pixel (Facebook / Instagram) — page views and signup conversions.
  • TikTok Pixel — page views and signup conversions.
  • Google Ads conversion tag — page views and signup conversions.
  These pixels set their own cookies on your device and may transmit your IP address, browser data, page URL and event data to the respective providers.

When you first visit the Service, a cookie banner lets you choose between "Accept all" and "Essential only". Marketing pixels are loaded only after you select "Accept all". If you select "Essential only" or do not interact with the banner, no marketing pixels are loaded and no related cookies are set.

You can change your choice at any time with the "Manage cookie preferences" button at the bottom of this page. Changes apply on your next page load. You may also disable cookies in your browser settings, but disabling strictly necessary cookies will prevent the Service from functioning.

2. How We Use Your Information

We use your information for the following purposes:

• Provide the Service: to operate the features you use — product research, the dashboards about your MercadoLibre account, the assistant, promotions, Ficanaz Link — and to apply the changes you confirm.
• Process payments: to manage your credits and your Pro subscription, process transactions and send billing-related communications.
• Communicate with you: to send transactional emails (account verification, password reset, a welcome email on your first confirmation, billing notices), respond to support requests and send service-related announcements.
• Keep the Service secure and fair: to authenticate you, apply rate limits, detect fraud and abuse of credits or referrals, and enforce our Terms.
• Improve the Service: to analyze aggregate usage, find and fix errors and improve functionality. Assistant conversations in which you rate an answer, together with your rating, are reviewed by our team to improve the assistant. Before any of them is used to evaluate the assistant, personal data of third parties (such as your buyers' names, email addresses, phone numbers, identity documents and addresses) is removed or anonymized.
• Legal compliance: to comply with applicable laws, regulations and legal processes, and to keep the accounting records we are required to keep.

We do not sell, rent or trade your personal information or the data of your MercadoLibre account, and we do not use your buyers' data for any purpose other than providing the Service to you. We do not use your data to train AI models.

3. How We Share Your Information

We share information only in the following circumstances.

3.1 Service Providers (Sub-processors)

These providers help us operate the Service. Each receives only the data required for its function:

• Supabase (database hosted in São Paulo, Brazil; company based in the USA) — database and authentication. Stores your account, profile, credits, search history, assistant conversations, Link activity and the data and cache of your connected MercadoLibre account, including the encrypted tokens. Also acts as the authorization server that issues the tokens used by Ficanaz Link clients.
• Vercel (USA) — website hosting, serverless functions and anonymized analytics. Receives request metadata (IP address, user agent, path) for routing, logs and abuse prevention.
• Anthropic (USA) — AI processing through the Claude API. Receives your research inputs, your messages to the assistant and the data the assistant reads from your MercadoLibre account in order to answer (listings, prices, stock, sales, questions, messages and claims, with buyers' personal details removed as described in Section 1.2). For product research the model may also run web searches. We do not send your name, email or account identifiers.
• Stripe (USA) — payment processing for credit packs and the Pro plan. Receives your payment details, email and transaction history.
• Resend (USA) — transactional email delivery. Receives your email address and the content of the email.
• Upstash (USA) — rate-limit counters keyed by account or IP address. No other data.
• Sentry (USA) — error and performance monitoring, as described in Section 1.4.
• Crisp (France) — support chat inside the app. Receives your name and email so we can reply, plus whatever you write in the chat.
• Cloudflare (USA) — DNS and email routing for our domain. Receives request metadata at the network layer and routes email sent to our addresses.
• Meta Platforms, TikTok and Google (USA / Singapore) — conversion measurement through their pixels, loaded only with your consent. See Section 1.5.

3.2 MercadoLibre

MercadoLibre is not our service provider: it is the platform you authorize us to access on your behalf. When you connect your account, MercadoLibre knows that Ficanaz is authorized and receives every request we make with your token, including the changes you confirm. MercadoLibre's own privacy policy governs what it does with that information. You can revoke our authorization from Ficanaz (Integrations → Disconnect) or from your MercadoLibre account settings.

3.3 AI Clients You Connect Through Ficanaz Link

If you use Ficanaz Link, the results of the tools your AI client calls — which include data from your MercadoLibre account, with buyers' personal details removed — are delivered to that client and processed by its provider (for example Anthropic for Claude, OpenAI for ChatGPT, or the provider of any other MCP-compatible client you choose) under your agreement with that provider. You choose which clients to authorize, and you can revoke any of them at any time from the Link panel. We do not control how those providers store or use what you send them, and this Policy does not cover their processing.

3.4 Other Circumstances

• Legal requirements: we may disclose your information if required by law, regulation, legal process or government request.
• Business transfers: if Ficanaz LLC is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With your consent: we may share your information for other purposes with your explicit consent.

4. Your Buyers' Data: Roles

For the personal data of your buyers that MercadoLibre makes available to the Service, you are the party responsible for that data (the "controller") under MercadoLibre's terms and applicable privacy law, and we process it on your behalf and on your instructions (as a "processor"), solely to provide the Service to you. We apply the safeguards described in Sections 1.2 and 5, we engage only the sub-processors listed in Section 3.1, and we delete that data when you disconnect your account or delete your Ficanaz account, subject to Section 6. If you need a signed data processing agreement, write to privacy@ficanaz.com.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Encryption of MercadoLibre tokens with AES-256-GCM, with the key kept outside the database
• Row-level access controls in the database so that each account can only reach its own data, and a policy that prevents tokens issued to Ficanaz Link clients from reaching the database directly
• Removal of buyers' personal details before data reaches an AI model
• Secure password hashing, rate limiting and security headers
• Periodic security reviews of our code and infrastructure

No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security breach that affects your personal data, we will notify you without undue delay, as required by applicable law. To report a security issue, write to security@ficanaz.com.

6. Data Retention

We retain your information for as long as your account is active. You can delete your account yourself from Settings; the deletion is immediate and covers your profile, credits, search history, favorites, assistant conversations, Link activity, subscription record and all data and cache of your connected MercadoLibre account, including the tokens. Disconnecting MercadoLibre without deleting your account deletes the tokens and the authorization right away. After deletion:

• We keep a one-way hash of your email address (not the address itself) so that welcome credits and the Pro trial are not granted twice to the same email.
• We keep your credit movements associated with that hash, without your name or email, for up to 7 years, so that we can audit charges and respond to refunds or chargebacks.
• Stripe retains billing records for up to 7 years as required by tax and accounting regulations.
• Backup copies of the database may persist for up to 90 days before being purged.
• Hosting logs and error reports are kept for up to 30 and 90 days respectively.

Assistant conversations are deleted automatically 90 days after each message. Conversations in which you rated an answer negatively are kept for up to 12 months so that we can review them and improve the assistant, and are then deleted. Deleting your account deletes them immediately.

You may also request deletion of your account and personal data by contacting us at privacy@ficanaz.com from the address registered to your account.

7. Your Rights and Controls

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data. You can edit your name and country in Settings.
• Deletion: delete your account in Settings, or request deletion, subject to the retention in Section 6.
• Data portability: request your data in a structured, machine-readable format.
• Objection and restriction: object to, or ask us to restrict, processing of your data for specific purposes.
• Withdrawal of consent: withdraw your consent at any time where processing is based on consent — for cookies with the button at the bottom of this page, for MercadoLibre by disconnecting your account, and for Ficanaz Link by revoking a client.

To exercise any of these rights, contact us at privacy@ficanaz.com. We will respond within 30 days.

8. International Data Transfers

Our database is hosted in Brazil, and most of our other service providers process data in the United States; AI clients you connect through Ficanaz Link may process data wherever their provider operates. By using the Service, you consent to the transfer of your information to those countries. Where the law of your country requires it, transfers to our providers rely on their standard contractual clauses or equivalent safeguards.

9. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete that information promptly.

10. Regional Disclosures

10.1 Argentina (Ley 25.326)

If you reside in Argentina, you have the rights of access, rectification, update and deletion of your personal data under Law 25.326 and its regulations. Access requests are answered free of charge at intervals of no less than six months unless a legitimate interest is shown. The Agencia de Acceso a la Información Pública, as the supervisory authority, has the power to handle complaints and claims regarding non-compliance with personal data protection rules.

10.2 Brazil (LGPD)

If you reside in Brazil, we process your data on the legal bases of performance of a contract, legitimate interest, compliance with legal obligations and consent (for cookies), under the Lei Geral de Proteção de Dados (Law 13.709/2018). You have the rights listed in Section 7, including confirmation of processing, anonymization or deletion of unnecessary data, information about the entities we share data with and the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Our contact for LGPD matters is privacy@ficanaz.com.

10.3 European Economic Area and United Kingdom (GDPR)

• Legal basis: we process your data based on contractual necessity (to provide the Service), legitimate interest (security and improvement), legal obligation (accounting) and consent (cookies and optional communications).
• Contact: for GDPR-related inquiries, write to privacy@ficanaz.com.
• Supervisory authority: you have the right to lodge a complaint with your local data protection authority.

10.4 California (CCPA)

If you are a California resident, you have the right to know what personal information we collect and how it is used, to request its deletion, to opt out of the sale of personal information (we do not sell personal information) and not to be discriminated against for exercising your privacy rights.

11. Third-Party Links

The Service contains links to third-party websites, including MercadoLibre and supplier platforms. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party site you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

For any questions or concerns about this Privacy Policy or your personal data, contact us at:

Ficanaz LLC
30 N Gould St, Ste R, Sheridan, WY 82801, United States
Email: privacy@ficanaz.com
Security reports: security@ficanaz.com
Support: support@ficanaz.com
Website: https://ficanaz.com

See also our Terms of Service and Refund Policy.

Manage cookie preferences

You can withdraw or update your consent for marketing cookies at any time. Clicking the button below will reopen the cookie banner so you can choose again. Changes apply on your next page load.